News for hackers. Stuff that matters.

A comment on If you’re not using SSH certificates you’re doing SSH wrong (2019). Parent comment

Re:If you’re not using SSH certificates you’re doing SSH wro... by imwillofficial on Thursday March 24, 2022 @12:15PM (#30791930)
If you didn’t know about SSH certs, you shouldn’t be giving advice. You should study the fundamentals
[ Parent | on HN ]
Re:If you’re not using SSH certificates you’re doing SSH wro... by OrvalWintermute on Thursday March 24, 2022 @01:56PM (#30793309)
I think you may also have missed the context that he/she used, as they described running an x509 CA first.

In an organizational context, many organizations are not going to jump to creating a novel CA type (SSH CA) when in fact regular x509 CAs are well known and the basis for much security, and many in regulated industries are using them already.

Additionally, given that he/she is running an x509 CA, telling someone with that experience to study the fundamentals is not very polite. It assumes the author of the comment is not educated, but the very description of his/her use-cases are not simplistic ones.

Engineering is all about tradeoffs after all.

[ Parent | on HN ]
Re:If you’re not using SSH certificates you’re doing SSH wro... by imwillofficial on Thursday March 24, 2022 @03:24PM (#30794274)
That’s a fantastic point. Mea culpa
[ Parent | on HN ]
Re:If you’re not using SSH certificates you’re doing SSH wro... by blueflow on Thursday March 24, 2022 @02:32PM (#30793687)
Your pronoun thing makes your text painful to read.
[ Parent | on HN ]
Re:If you’re not using SSH certificates you’re doing SSH wro... by jjulius on Thursday March 24, 2022 @03:14PM (#30794173)
... it genuinely pains you to read "he/she"?
[ Parent | on HN ]
Re:If you’re not using SSH certificates you’re doing SSH wro... by egberts1 on Friday March 25, 2022 @07:43AM (#30800904)
That’s why I use “one”.
[ Parent | on HN ]
Re:If you’re not using SSH certificates you’re doing SSH wro... by OrvalWintermute on Thursday March 24, 2022 @04:59PM (#30795259)
I just didn't want to assume gender, and didn't want to go through comment history in order to find it.
[ Parent | on HN ]
Re:If you’re not using SSH certificates you’re doing SSH wro... by rfrey on Thursday March 24, 2022 @09:46PM (#30797829)
You would seem to have a very low pain threshold.
[ Parent | on HN ]
Re:If you’re not using SSH certificates you’re doing SSH wro... by digitallyfree on Thursday March 24, 2022 @02:04PM (#30793404)
I'm not familar with SSH certificates, but I do know the fundamentals of certificate-based authentication. If you don't have a way to revoke the cert, then the server will assume that your properly signed unexpired certificate is valid. You will need some way to let the server know that the previously issued cert is not valid anymore.

This is how this type of authentication works, and the article did not address the important case of wanting to revoke a user's credentials.

[ Parent | on HN ]